Method and apparatus for distributed rule evaluation in a near real-time business intelligence system

ABSTRACT

A method is provided for performing an action, in a distributed environment, upon occurrence of a monitored event related to a set of data elements. The method includes providing a rule that includes an event identification component which specifies an event to be monitored and an action component which specifies an action to be performed when the event has occurred. The method also includes determining, from the rule, if the event identification component is to be evaluated by a remote event engine and if the action component is to be evaluated by the remote event engine, evaluating the event identification component and the action component of the rule.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application claims the benefit under 35 USC 120 of U.S. patentapplication Ser. No. 10/289,142, filed Nov. 5, 2002, entitled “Methodand Apparatus For Distributed Rule Evaluation In A Near Real-TimeBusiness Intelligence System,” which claims benefit under 35 USC 119(e)of U.S. Provisional Application No. 60/410,989, filed Sep. 16, 2002,entitled “Business Intelligent System,” and under 35 USC 120 of U.S.patent application Ser. No. 10/237,559, filed Sep. 6, 2002 entitled“Enterprise Link For a Software Database,” all of which are incorporatedby reference.

BACKGROUND OF THE INVENTION

The present invention relates in general to enterprise informationsystems. More particularly, the present invention relates to methods andapparatus for optimizing the delivery of data to a device.

Timely intelligence is critical to proper business decision making.Collecting and quickly analyzing information, however, is oftendifficult. In a dynamic marketplace, delayed delivery of intelligencecan reduce both its reliability and relevancy. Substantial delays caneven make the information, often acquired at considerable cost,completely worthless.

Intelligence is often extracted from OLTP applications and fromspecialized databases, called operational data stores, OLTP (onlinetransaction processing) applications are those enterprise systems thatmanage a company's basic transactions, such as order entry and billingsystems. Since they are commonly optimized for reading and writing, andnot for querying, extracting information from an OLTP application can besufficiently complex to require additional user training. Furthermore,while operational data stores generally archive OLTP information in aformat for querying, they also generally do not maintain importanthistorical information. For instance, an operational data store maystore a current checking account balance, but not the individual dailybalances over the previous month.

In addition, the queries themselves often take substantial time toexecute, producing only static snapshots of the information. Observingthe dynamic aspect of changing information is therefore difficult. Apossible solution may be to sequentially execute and aggregate a seriesof queries. However, this solution can be both inefficient andineffective, since manual manipulation still often delays theinformation delivery. That is, these queries must be first manuallyaggregated and summarized, before intelligence reports can be generatedand delivered.

ETL (extraction, transformation, and loading) systems help byextracting, transforming, and aggregating the information. But latencyinherently found in most distributed networks, coupled with considerablemanual intervention that ETL systems often require, mean that criticalinformation can still be received late.

Automatic notification is a possible solution. Many analytical productssuch as business intelligence (BI) and online analytical processing(OLAP) systems are capable of monitoring, scheduling, and broadcastingalerts via email or pager. These systems, however, cannot generallyassure that the intended recipient promptly receives and reads themessage. This presents a significant problem for time-sensitiveinformation, where minutes or even seconds can make a difference.

To facilitate discussion, FIG. 1 shows a simplified functional diagramof distributed information architecture. The diagram can be divided intoan enterprise data layer 160 and a client layer 162. Enterprise datalayer 160 comprises elements that are primarily focused on accumulating,processing, and transforming operational data. Client layer 162comprises elements that are primarily focused on rendering the processeddata for a user.

OLTP (online transaction processing) applications 152 are commonlycoupled to each other, as well as to other enterprise applications,through a dedicated messaging and queuing application (MQ), such asIBM's MQSeries. MQ provides an efficient communication channel for theseapplications, by storing and forwarding data messages, in a manner thatis similar to email.

Commonly coupled to each OLTP application 152 is operational data store154, such as an Oracle database. Through an API (application programminginterface), transactional data can be transferred between the OLTPapplication and the database. Operational data store 154 consolidatesthat data from multiple sources and provides a near real-time,integrated view of volatile, current data. Since its purpose is toprovide integrated data for operational purposes, operational data store154 primarily has add, change, and delete functionality.

In order to conduct meaningful analysis, this information is oftenfurther placed in a more stable environment, optimized for randomquerying. ETL system 155 extracts the information from the appropriatedata store 154, transforms and combines the data based on pre-definedconstraints, and subsequently loads the data into data warehouse 156. Apopular ETL technique, developed by Sagent, is the use of data flows.

Data flows are a series of rule-enabled transformations that areconnected in data pipelines. They handle the tasks of joining, merging,comparing and splitting data and permit the separation of data intodifferent logic paths, each of which can be further combined and splitoff to create more complex transformation sequences.

ETL data extractions often occur by either a bulk or a trickle method.In the bulk method, periodic snap shots of data in operational datastore 154 are extracted and uploaded into data warehouse 156. Thiscommonly occurs as a large batch file scheduled during a low systemutilization period. In the trickle method, changes in operational datastore 154 are continuously uploaded, or “trickled” into data warehouse156. These updates are therefore frequent, smaller, and more currentthan in the bulk method. As in the case of OLTP 152 systems, ETL 155 canalso use the MQ for data extraction.

Once the data is in data warehouse 156, it is available for OLAP 158(online analytical processing). OLAP enables trained users to perform adhoc analysis of data in multiple dimensions, such as with an OLAP cube.OLAP cubes provide multi-dimensional views of data, querying, andanalytical capabilities. Furthermore, many OLAP products can schedule,run, publish, and broadcast reports, alerts and responses over thenetwork, email, or personal digital assistant. Users often access OLAP158 by thin client 162. Thin clients are applications that generally areintegrated into the underlying client device, and generally requireminimal modification. For instance, a thin client can be browser with aMacromedia Flash module installed.

Although OLAP analysis can provide valuable insight about businessoperations, critical information is often received late, even withautomated reporting. Automated OLAP reporting often only has access tothe information within data warehouse 156, which can be severalprocessing stages behind OLTP 152. This delay can be substantial,reducing the information's value. Furthermore, these reports are oftenonly static snapshots of information in data warehouse 156.

For example, a NASDAQ broker places an order into an OLTP 152application called an electronic communications network, or ECN. The ECNmatches customer buy and sell orders directly through the computer. Inthis case, an order to buy 100 shares of ABC at $18.75 was entered. Thisopen order is stored in the ECN operational data store 154, subsequentlyextracted by ETL 155, and analyzed by OLAP 158. If the buy order amountis the then highest in the ECN, OLAP 158 forwards the information tothin client 164, NASDAQ quote montage, where it is immediately displayedon the familiar stock market ticker tape. And although this systemdelivers stock information to individual brokers with reasonably smalllatency, it is also not easily modified. The NASDAQ application iscustom designed for the specific purpose of enabling stock trading. Assuch, it would be difficult to display additional data on the stockticker, such as non-financial information, without substantialadditional programming.

In view of the foregoing, there is desired a method and apparatus foroptimizing the delivery of data to a device, in which relevantinformation is received in a timely manner, and in which that data isrendered in a dynamic format.

SUMMARY OF THE INVENTION

The invention relates, in one embodiment, to method for optimallymonitoring a set of data elements for an event. The method includesdetermining a set of data elements, each of which further comprises astate. An event is commonly a change in this state. The method furtherincludes creating a rule for monitoring the event, wherein the rulecomprises an event identification portion resident on a first computerand an action portion resident on a second computer. The method alsoincludes monitoring the set of data elements for the event based, inpart, on the event identification portion, and determining if the eventhas occurred. If so, the method further includes sending the set of dataelements to the second computer. The method also includes executing aset of actions, based in part, on the action portion. Thereafter, themethod further includes monitoring the set of data elements based, inpart, on the rule.

In another embodiment, the invention relates to an apparatus foroptimally monitoring a set of data elements for an event. The apparatusincludes a means for determining a set of data elements, each of whichfurther comprises a state. An event is commonly a change in this state.The apparatus further includes a means for creating a rule formonitoring the event, wherein the rule comprises an event identificationportion resident on a first computer and an action portion resident on asecond computer. The apparatus also includes a means for monitoring theset of data elements for the event based, in par, on the eventidentification portion, and a means for determining if the event hasoccurred. If so, the apparatus further includes a means for sending theset of data elements to the second computer. The apparatus also includesa means for executing a set of actions, based in part, on the actionportion. Thereafter, the apparatus further includes a means formonitoring the set of data elements based, in part, on the rule.

These and other features of the present invention will be described inmore detail below in the detailed description of the invention and inconjunction with the following figures.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example, and not by wayof limitation, in the figures of the accompanying drawings and in whichlike reference numerals refer to similar elements and in which:

FIG. 1 illustrates a simplified functional diagram of distributedinformation architecture;

FIG. 2A-B illustrate, in accordance with one embodiment of the presentinvention, simplified functional diagrams of the active data platform;

FIG. 3A illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying the active studioapplication;

FIG. 3B-E illustrate, in accordance with one embodiment of the presentinvention, several simplified de-normalized tables as would be used inan active data cache.

FIG. 4 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying an event engine;

FIG. 5 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying components of therich client and active data cache.

FIG. 6 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying components of themessage center;

FIG. 7A-E illustrate, in accordance with one embodiment of the presentinvention, exemplary screen displays.

FIG. 8A-B illustrate, in accordance with one embodiment of the presentinvention, an active collaboration server advantageously employed toallow impromptu graphical collaboration between IM users;

FIG. 9A-B illustrate, in accordance with one embodiment of the presentinvention, simplified functional diagrams of a rules-based monitoringengine with alert capability;

FIG. 10A-C illustrate, in accordance with one embodiment of the presentinvention, simplified pseudo-code as would be used by IM client.

FIG. 11 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram of the active data platformwith elements of the notification and escalation process;

FIG. 12 illustrates, in accordance with one embodiment of the presentinvention, a simplified diagram of a common instant messaging clientdisplaying a notification message; and,

FIG. 13 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram of an active data platform inwhich distributed rule evaluation is implemented.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The present invention will now be described in detail with reference toa few preferred embodiments thereof as illustrated in the accompanyingdrawings. In the following description, numerous specific details areset forth in order to provide a thorough understanding of the presentinvention. It will be apparent, however, to one skilled in the art, thatthe present invention may be practiced without some or all of thesespecific details. In other instances, well known process steps and/orstructures have not been described in detail in order to notunnecessarily obscure the present invention. The features and advantagesof the present invention may be better understood with reference to thedrawings and discussions that follow.

In accordance with one embodiment of the present invention, an activedata architecture is advantageously employed to facilitate thepresence-aware delivery of timely data. That is, determining the type ofdevice available to the user, and delivering the information in a formatwithin the device's capabilities. In accordance with another embodimentof the present invention, information can be continuously extracted fromdata sources without the need for manual queries, or additional usertraining. In accordance with another embodiment of the presentinvention, information may be dynamically delivered in order to renderstreaming real-time or near real-time data and/or analytical results,whether graphically, textually, audibly, or otherwise.

Referring now to FIG. 2A, a simplified functional diagram of an activedata platform is illustrated. Active data platform 210 comprises a suiteof applications that allow a user to actively monitor continuouslychanging information, throughout enterprise data layer 140, according toa pre-defined set of rules. A rule may be a pre-defined procedurecomprising the events to be monitored, and the subsequent action ortransformation that may be required. These rules enable active dataplatform 210 to extract, combine, and transform data from varioussystems, as well as the MQ messages transferred among the applications,in a substantially contemporaneous manner. This processed informationcan then be transmitted in substantially near real-time to devices inclient layer 142. For example, processed information can arrive at aclient layer 142 device within 2-10 seconds of an event or transaction,or even sooner. Depending on the type of client device, this processedinformation can be received as a continuous data stream, a staticreport, or an alert. The processed information can also be stored in adata warehouse and compared with future information.

As in FIG. 1, OLTP 102 generates transactional information. Operationaldata store 104 consolidates that data from multiple sources and providesa near real-time, integrated continuously updated view of data. ETLsystem 105 extracts the information from the appropriate data store 104,transforms and combines the data based on pre-defined constraints, andsubsequently loads the data into data warehouse 106 that is optimizedfor querying, or random data retrieval. The ETL extraction can occur ineither a bulk or a trickle method. Once the data is in data warehouse106, it is available for OLAP 108, or online analytical processingapplications. OLAP enables trained users to perform ad hoc analysis ofdata in multiple dimensions, such as with an OLAP cube.

Through the use of browser technology, such as DHTML, thin client 114and a rich client 282 provide the user with enhanced visualizationfunctionality, such as the capability to graphically render streamingdata. Thin client 114, in one embodiment, is called active viewer, andcomprises a browser. Rich client 282, in another embodiment, is calledactive viewer pro, and comprises a browser with additionally installedsoftware. DHTML is a combination of HTML, style sheets, and scripts, andallows web-pages to be animated. In addition, rich client 282 furtherallows for enhanced functionality, such as pen-based user input, secureinstant messaging, robust printing capability, and the use of skins.Skins are configuration files that allow modification of the browserappearance. Messaging client 115, such as a SMS cell phone, or aninstant messaging program, such as Yahoo Messenger or Windows Messenger,provides alert capability. These alerts, as well as static reports, canalso be received through thin client 114, such as a browser. Other 280represents those enterprise applications that have been programmaticallycoupled to active data platform 210, as a client.

In one embodiment, client applications in client layer 142 can reside ona Tablet PC. The Tablet PC represents the evolution of the businessnotebook personal computer. It marks a new direction for notebook PCs,adding pen-based technologies to existing notebook functionality andenabling Windows XP-compatible applications to take advantage of variousinput modes, such as pen and voice-based data. The Tablet PC will beamong the most versatile PCs ever made, with high-powered and efficientprocessors, lightweight designs, and, for man, built-in wirelesscapability. All Tablet PCs will have keyboards, some permanentlyattached and others detachable. But the Tablet PC is more than just agreat notebook. The real value of the Tablet PC is that it makes itpossible for information workers to bring the power of their business PCinto more places than ever before, and they can do it with the samesoftware they use on their office PC or notebook today.

For example, betting transactions would be normally stored in a casino'sgame transaction system. Wanting to be extra-attentive to high-rollers,a casino would configure the active data platform to observe for anycustomer whose betting exceeds a specified threshold, upon which analert would be sent to the closest pit boss. The pit boss would locatethese customers and personally oversee that exceptional customer servicewas provided.

FIG. 2B illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying elements of theactive data platform 210, shown in FIG. 2A. Enterprise links 254comprises adaptors that allow active data cache 256 to be coupled to theapplications in enterprise data layer 140. Furthermore, these adaptorscan also selectively filter and transform incoming data for active datacache 256. For instance, adaptors in enterprise link 254 can allowactive data cache 256 to connect to enterprise applications (i.e., SAP,Siebel, and PeopleSoft), databases (i.e., Oracle, Informix, Sybase, DB2,and SQL Server), legacy applications (i.e., IBM S/390 mainframes), OLTP(i.e. order entry, billing, payment, etc), and MQ applications (i.e.,IBM MQSeries, Vitria, Tibco, etc.).

Active data cache 256 is the core repository for the active dataplatform. Unlike traditional databases, such as operational data store104 and data warehouse 106, active data cache 256 stores data in ade-normalized format. Normalization is the practice of optimizing thedatabase structure into multiple tables, eliminating data redundancy andimproving sealability and maintainability.

Since active data cache 256 is primarily focused on automatic reporting,and not on querying, it generates substantially de-normalized tablesrepresenting each report or data stream. By logically placing thesede-normalized tables near client layer 142, in a non-obvious fashion,fewer processing stages are required and latency is substantiallyreduced.

Database tables are not commonly de-normalized, since data isduplicated. In general, duplicated data tends to increase the likelihoodof data corruption during updates. That is, multiple separate entries nolonger match each other. Furthermore, de-normalized tables tend to bemore difficult to query than normalized tables, since each individualdata record may be substantially larger, and hence take longer tosearch. This is even more so if the table is not properly indexed.However, since ad-hoc querying is not a substantial requirement, andtable joins are not necessary, normalization enables database tableswithin active data cache 256 to be optimized for the efficient creationof pre-defined reports and alerts. In one embodiment, a singlede-normalized table is the source for each report.

Active design process 290 is powerful, intuitive suite of applicationsthat allow a user to create rules, map onto message queues, managesecurity, define data objects, and configure enterprise link 254processes and sources, based on simple drag-and-drop operations for thedata streams, reports, and alerts. In addition to active design process290 in active data layer 241, there is a corresponding active designprocess client in client layer 142, such as a web browser. In oneembodiment, active design process 290 comprises an application entitledarchitect. Unlike traditional real-time business intelligenceapplications, active design process 290 allows a user to dynamically addnew data sources, or create new transformations and reports, withoutchanging the system as a whole. That is, unlike the NASDAQ stock tradingexample previously shown, which is not easily modified, active designprocess 290 can easily tailor the active data platform to newapplications and changing corporate infrastructures.

Active report engine 274 converts the raw information in active datacache 256 into charts, tables, and graphs for display on a device in theclient layer 142. Active studio 291 is a presentation editor that allowsa user to easily create and format specific graphical and textual activeviews of data, based on pre-defined templates. Common views are tables,pie graphs, bar graphs, line graphs, scatter graphs, columnar reports,form reports, geographic (map) views, crosstabs, and Excel integration.For instance, a user can create an hourly report in which gamblingcustomers are aggregated into different groups based on the value oftheir accumulated betting that day. The user selects a bar graph for thereport, and changes the fill color and font type to the user'spreference. These views can be substantially active, changing in nearreal time as the underlying data changes, or can be static, like aprinted report.

Event engine 257 monitors the information in active data cache 256 forpre-determined changes, or events. Once an event occurs, such as arising temperature in a chemical processing plant, message center 272 isnotified, subsequently forwarding the appropriate message to messagingclient 115, thin client 114, or rich client 282.

In one embodiment, message center 272 tracks the presence of clientdevices, as well as the status of users themselves, in order tosubstantially assure message delivery. This is in contrast totraditional messaging systems that cannot determine if messages are, infact, delivered to intended recipients. Presence determines if thedevice is available on the network. Status determines if the intendedrecipient is available to read and respond to the instant message.Common status categories include descriptive information, such as “outto lunch”, “busy”, “away from desk”, “important meeting”, etc. Forinstance, the device may be turned on and available, but the intendedrecipient is in an important meeting and does not wish to be disturbed.The intended recipient sets the status to “important meeting” in orderto notify message center 272, as well as any other subscribed user, thathe will probably not respond to the alert until after the meeting.Message center 272 would then choose an alternative available recipient,based on an established notification rule.

For example, a casino's active data platform attempts to notify thenearest pit boss of a particularly prolific gaming customer. However,since the pit boss has a “busy” status, the casino manager is alertedinstead, and subsequently walks over to greet the customer.

Enterprise security system 258 represents a company's existing securityinfrastructure, such as Steel-Belted Radius by Funk Software. Sinceoperational information may be sensitive, active data cache 256 can beintegrated into enterprise security system 258. In this way users areauthenticated before information is transmitted to client layer 142devices.

FIG. 3A illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying the active studio304 application of active data platform 210, as shown in FIG. 2B. Inaddition to active studio 304 application in active data layer 241,there is also a corresponding active studio 304 client in client layer142, such as a web browser.

FIG. 3B-E illustrate, in accordance with one embodiment of the presentinvention, several simplified de-normalized tables as would be used in acasino's active data cache 256, as shown in FIG. 3A. Referring to FIG.3B, a de-normalized table is shown describing payouts at specific gamingtables on the casino floor. For example, table 1, whose current pit bossis Jones, and whose current dealer is Brown, has a payout of $2000.Referring to FIG. 3C, a de-normalized table is shown describing thecurrent location of players in a casino. For example, player Bill Smith,who is a high roller, is currently at slot machine #1. Referring to FIG.3D, a de-normalized internal table is shown describing active serveruser profile information. For example, a system user with ID#1 prefersto receive notifications and alerts through email. Referring to FIG. 3E,a de-normalized table is shown describing the slot machine playerlocations, as well as slot machine statistics. For example, at slotmachine #1, Jones is the responsible pit boss, current player is ID, theslot machine has been idle for 5 minutes, the payout over time has been$5000, and the number of plays to win on average is 2000.

FIG. 4 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying event engine 257,as shown in FIG. 3. Event engine 257 is configured to monitor for avariety of events 402 generated throughout the network, as well aswithin the active data platform itself. A viewset event 406 b is achange to a modified data object, such as a database table with afilter. It would be generated by active reports engine 274, as shown inFIG. 2B. A system event 406 e is generated from the underlying operatingsystems or application, for instance, a change in virtual memory or acache miss. A file event 406 f is a change to a given file as stored ina file system. A performance event 406 g is a change in a system'sperformance, such as virtual memory utilization or network latency. Amanual event 406 h is an event entered by a user. An external event 406i is an externally generated through an API, and is used for such thingsas functional system verification. A time event 406 j is a change in thepassage of time, similar to a timer. A date event 406 k is a change indate. And, a presence event 462 l is the discovery of a client instantmessaging device that was previously offline, or the availability statusof a recipient has changed.

Event engine 257 is further comprised of four logical components: eventgenerator manager 428, rules manager 408, accountability manager 410,and actions manager 412. Event generator manager 428 maintains the stateinformation of monitored events 402 for rules manager 408. Rules manager408 is the primary event handler for the active data platform.Accountability manager 410 monitors the delivery status of all reportsand alerts. And, actions manager 412 initiates actions based on inputfrom the actions module 434 of the rules manager 408.

Event generator manager 428 maintains state information of monitoredevents 402 for rules manager 408. Constraint module 426 specifies theparameters that must be satisfied before evaluating an event and/or acondition and/or before applying the rule. Conditions module 424maintains information for the corresponding conditions module 432 inrules manager 408. It further specifics attributes relevant to thespecific event, other than constraints, which must be satisfied beforethe action associated with the rule may be taken. Events module 425maintains event information for the corresponding events module 430 inrules manager 408.

Rules manager 408 further includes three components in order to manageactive data: an events module 430, a conditions module 432, and anactions module 434. Events module 430 monitors all generated events 402within the active data platform. Conditions module 432 filters outnon-relevant events, and forwards the information to actions module 434,which in turn, initiates new system events based on criteria within rulesets 256. For example, all betting transactions are sent as events toevent generator manager 428, which in turn sends the information to theevents module 430 of rules manager 408. The conditions module 432 isconfigured to subsequently filter out all but the blackjack events. Theactions module, based on rules 256, then creates an internal systemevent to instruct the active reports engine 274, as shown in FIG. 2B, tocreate a report for all blackjack transactions above a threshold, asdescribed in rules 256.

Accountability manager 410 monitors the delivery status of all reportsand alerts. It further includes an unaccounted notifies module 438, anda report engine tie module 436. The unaccounted notifies module 438maintains the status of undelivered alerts and reports. That is,unaccounted notifies module 438 determines if a recipient cannot bereached, subsequently forwards a delivery-incomplete message to rulesmanager 408. Report engine tie 436 monitors for successfully receivedreports and alerts, and subsequently forwards a delivery-completemessage to rules manager 408. For example, a receipt notification statusmessage is received in accountability manager 410, which is subsequentlyprocessed. If the receipt notification status message comprises anacknowledgment, report engine tie module 436 further processes themessage and forwards the information to rules manager 408. However, ifan acknowledgment is not received, unaccounted notifies module 438processes the message and forwards the information to rules manager 408,which in turn allows active data cache to escalate alerts and reports toalternate recipients, based on status and presence, should the originalrecipient be unavailable.

Actions manager 412 initiates events and actions based upon input fromthe actions module 434. It further includes a notification module 416, agenerate event module 414, a run a plan module 418, a web service/MQmodule 420, and an others module 422. Notification module 416 forwardsany report and alert non-delivery messages to unaccounted notifiesmodule 438. Generate event module 414 generates system events initiatedby actions module 434 in rules manager 408. Run a plan module 418executes script based on rules 256. Web service/MQ module 420 providesan interface to third-party web-services based on WSDL (web-servicedescription language), as well as message queue applications. Othersmodule 422 is an API that allows additional modules to be later added.

FIG. 5 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying components of richclient 282 and active data cache 256, as shown in FIG. 3.

Rich client 282 is comprised of a main application 536, a renderedreports 540 component, and a re-notify applet 506 component. Mainapplication 536 provides the core environment for client interface tothe active data cache 256. It comprises several functional componentsthat can dynamically render incoming data streams from active data cache256, and locally create reports, such as report builder 538. Renderedreports 540 functions as a viewer to display reports from active datacache 256 which already have been assembled. Re-notify applet 506displays notification messages to the user.

In a non-obvious fashion, rich client 282 substantially maintains anopen TCP-IP connection to active data cache 256, through the executionof blocking HTTP request in a second open browser window. Internetbrowsers normally implement HTTP, an asynchronous protocol that usesmultiple short-lived synchronous TCP-IP connections to render theobjects on a web page. For instance, a connection is opened, a pictureis rendered, and the connection is closed. However, in the currentinvention, a web server periodically sends keep-alive messages to thesecond open browser window, in order to prevent a TCP-IP connectiontimeout. Through the use of this code, a TCP-IP connection is kept open,allowing data to be sent in a substantially continuous way to richclient 282, without having first to refresh the browser window. Thus,the dynamic rendering process in the primary browser window is morereadily controlled. For example, the following JavaScript code may beexecuted by the second browser window:

Line 1: <script id=’s1’> Line 2: parent.ProcessActiveData(‘’ +viewsetID + “’,’”+strXML + “ ‘); Line 3: s1.removeNode(true); Line 4:</script>viewsetID indicates the viewset to which the active data applies,whereas strXML refers to an XML document describing new data. Line 1indicates to the browser that the following section need not be renderedsince it is a script section. The execution of line 2 causes the reportin the main application (active studio or active viewer) browser tochange. The execution of line 3 removes the script from the page. Andline 4 indicates to the browser that the script section has ended.

Active data cache further comprises functional components thatfacilitate the generation of a report. These are: a report executioncomponent 522, a view execution component 524, a report buildercomponent 528, a rule builder component 530, a modifier buildercomponent 532, data object builder component 534, a structured datasupplier component 526, and a message center gateway 536.

Report execution 522 creates, caches, and then forwards specific reportsbased on configuration, to either rendered reports 540 for reportbuilder 538. View execution 524 likewise creates and forwards views toreport builder 538. Views are data objects that may be filtered. Reportbuilder 528 pre-processes extracted information from multiple sources,and transforms the aggregated data into a format optimized for use inmultiple reports. Rule builder 530 pre-processes stored rules frommultiple rule caches for use in the generation of multiple reports.Modifier builder 532 pre-processes intermediate informationtransformations, such as additional metrics that the user wishescalculated and reported. Data object builder 534 pre-processes dataobjects into optimized formats for report execution component 522.Structured data supplier 526 forwards external pre-processed data toreport builder 528.

FIG. 6 illustrates, in accordance with one embodiment of the presentinvention, a simplified functional diagram displaying components ofmessage center, as shown in FIG. 3. Message Center 272 providesmessaging functionality to the active data platform. It allows reportsand alerts to be sent via heterogeneous channels to a plurality ofclients. Message center 272 further includes an API layer 605, apresence and notify 612 module, a rich client 614 interface, a thinclient 616 interface, an email interface 618, an IM interface 620, otherinterfaces 624, a local user information 626 module, and an IM clientmanager 628 module.

API layer 605 provides a uniform application interface for systemgenerated events, such as notification request 608, administrationrequest 606, and presence request 604. Presence and notify component 612provides the main messaging infrastructure for the active data platform.It insures that reports and alerts are properly routed to intendedrecipients. Local user information 626 maintains a local cache of userprofile information, such as names, passwords, and delivery preferences.

Rich client interface 614 is further coupled to rich client 282, whichprovides the user with enhanced visualization functionality, such as thecapability to graphically render streaming data. Thin client interface616 is coupled to thin client 112, which further comprises agentapplication 660. Since thin client 114 is commonly a browser withoutpresence functionality, agent 660 notifies presence and notify component612 that a given report or alert is being viewed. Agent 660 is commonlyan Active X component or a java applet. Email interface 618 is furthercoupled to email server 632, such as an SMTP server, which forwardsmessages to email client 115 a. IM interface is further coupled to IMclient manager 628 which sends a notification request 630 to IM client115 b. Instant messaging (IM) is a means for sending small, simplemessages that are delivered immediately to online users. It differs fromemail primarily in that its primary focus is immediate end-userdelivery. Through an IM client application, a user can discover andimmediately begin a text conversation, or chat session. Common publicinstant message systems include AOL Instant Messenger, MSN Messenger,Yahoo! Messenger, Microsoft Exchange 2000 IM, and Lotus Sametime.

For example, a casino's active data cache identifies particularlyprolific gaming customer. The active data cache forwards a notificationrequest 608 to message center 272. The presence & notify module 626 thendetermines if the intended user's device is present, and the user isavailable. If so, message center 272 forwards an alert through IMinterface 620 to IM server 630, and finally to IM client 657.

Unlike like the prior art, the active data platform is general purpose,and is substantially customizable by entering new parameters in activedesign process 290 and the active studio 291, as shown is FIG. 3A.Furthermore enterprise links 254, also shown in FIG. 3A, allows activedata platform to quickly adapt enterprise data sources to changingnear-real time BI needs.

Referring now to FIG. 7A, an exemplary active studio screen display isshown according to an embodiment of the invention. This display is usedby a user in order to easily manage the generation and secure deliveryof data streams, reports, and alerts, without substantial additionalcomputer programming.

The display is divided into three sections, a tab pane 701, a functionpane 714, and a display pane 715. Tab pane 701 further allows the userto select one of various functional displays within active studio 304,such as: home 705, my reports 706, shared reports 707, personalize 708,and alerts 709. Home 705 comprises a summarized view of the user's mostrecent activities. My reports 706 comprises a summarized list of theuser's created reports. Shared reports 707 comprises a summarized listof third-part reports to which the user has subscribed. Personalize 708comprises administrative components that can allow the user to modifyreport delivery and display parameters. And alerts 709 comprises asummarized list of a user's active alerts.

Function pane 714 displays several functional list boxes within home 705tab, such as: recent list box 710, new list box 711, list toolbox 712,and actions list box 713. Recent list box 710 displays the user's mostrecently accessed reports. The new list box 711 displays the user's newreports. The alerts list box 712 displays the user's currently activealerts. And the actions list box 713 allows the user to create and editreports. Display pane 715 displays the corresponding result of the chosefunction of function pane 714. In this case, a dynamic financial reportcomprising a cost bar graph and a percentage change line graph. Forexample, if a user where to select intraday sales by region in the newlist box 711, the corresponding dynamic intraday sales report would bedisplayed in display pane 715. As sales are booked through out the day,the sales chart would dynamically change as well.

Referring now to FIG. 7B, an exemplary report viewer screen is depictedaccording to an embodiment of the invention. There are three functionsavailable from this view, launch active studio 719, email 717, and print718. Display pane 715 allows the user to view the selected report, inthis case, a Q1 sales report. Launch active studio 719 allows the userto open the viewed report in the Iteration Active Studio. Email 717allows the user to mail the viewed report to an email recipient. Print718 allows the user to print out the viewed report on an attachedprinter.

Referring now to FIG. 7C, the exemplary active studio screen display ofFIG. 7A is shown with the components of my reports tab 706. Functionpane 714 further displays two sub tabs, a task bar tab 723 and a folderstab 724. Task bar 723 tab allows the user to select various functionsrelated to the current view, in this case, a report summary view.Folders 724 tab allows the user to organize created or stored reports inan hierarchical format. Two components within the task bar tab 723 arereport creation 725 and guide 726. Report creation 725 allows the userto create new active data. Guide 726 provides a source of online help tothe user.

Referring now to FIG. 7D, the exemplary active studio screen display ofFIG. 7 e is shown with additional components of the my reports tab 706,such as the report creation toolbox 723, the report properties toolbox748, and the guide window 749. The report creation toolbox 723 furthercomprises functions to easily create specific graphical views 740 ofdata, based on pre-defined templates. Common views are tables, piegraphs, bar graphs, line graphs, scatter graphs, columnar reports, formreports, geographic (map) views, crosstabs, and Excel integration. Theseviews can be further modified in the report properties toolbox 748. Forinstance, a user can create an hourly report in which gambling customersare aggregated into different groups based on the value of theiraccumulated betting that day. The user selects a bar graph for thereport, and changes the fill color and font type to the user'spreference.

Referring now to FIG. 7E, the exemplary active studio screen display ofFIG. 7 e is shown with an additional example of the my bar graph 776function window, which allows the user to further customize the selectedreport with specific data objects and files. In general, three types ofattributes can be customized: views 770, data 772, and properties 774.Views 770 allows a user to modify the types of graphical displaysavailable in which to view the current data, such as a bar graph, linegraph, etc. Data 772 allows a user to select the specific data fields tobe used in views 770. Properties 774 allows a user to modify otherattributes, such as language, number formats, etc. In this case, theuser has selected a bar graph template for the report, and has addedfour fields.

In another aspect of the invention, an Iteration instant messaging &collaboration server is advantageously employed to enable rich securegraphical collaboration in an instant messaging environment. Instantmessaging systems commonly monitor the presence of devices, andavailability state of users. Presence determines if the IM device iscoupled to the given IM network, or at least reachable from the client.Status determines if the intended recipient is available to read andrespond to the instant message. Common status categories also includedescriptive information, such as “out to lunch”, “busy”, “away fromdesk”, “important meeting”, etc. For instance, the IM device may beturned on and available, but the user is in an important meeting anddoes not wish to be disturbed. The user would set the status to“important meeting,” in order to notify other subscribed IM users thathe will probably not respond to a text message until after the meeting.

These IM systems, however, commonly lack the capability for graphicalpeer-to-peer or multi-party collaboration. That is, while short textmessages can be sent back and forth in an online chat meeting, there isno comparable means for sharing a graph or report. This would normallyhave to be compressed and transmitted ahead of time to each recipient,who would each then download, de-compress, and locally store the file.In situations where the underlying data is continuously changing, astemperatures would be in a chemical plant, and impromptu collaborationis desired, pre-mailing a graph would be very impractical, inefficient,and of marginal use to the problem at hand.

Furthermore, public IM systems are not particularly secure. They wereoriginally designed for rapid information text conversations, calledchat. IM protocols emerged and were established primarily withoutsupervision from any standard bodies, such as the Internet EngineeringTask Force. Subsequently, security was never originally considered andcommon instant messaging traffic is essentially unencrypted. Just aboutanyone on the network can secretly monitor a chat conversation.

FIG. 8A illustrates, in accordance with one embodiment of the presentinvention, an active collaboration server advantageously employed toallow impromptu graphical collaboration between IM users. As shown inFIG. 2B, event engine 257 forwards an event, such as a temperaturechange, to message center 272, through API 803. Event engine 257monitors the information in active data cache 256 for pre-determinedchanges, or events. Message Center 272 provides messaging functionalityto the active data platform, allowing reports and alerts to be sent viaheterogeneous channels to a plurality of clients.

User manager 811 manages user profile information. Users create profilesbased on rules, in which they describe events of which they want tonotified. Should such an event occur, user manager 811 notifies messagecenter 272, which in turn contacts the user. Furthermore, user manager811 selects alternative recipients, if the primary recipient isunavailable, based on user preference and availability status. Forinstance, user #1 has configured user manager 811 for notification of aspecific event, for example a temperature change beyond a certain range.Furthermore, user #1 also wants user #2 to be notified should user #1 beunavailable. Once the event occurs, if user #1 is unavailable, messagecenter 272 attempts to notify user #2. Presence manager 813 monitors forthe availability of user devices on the network. For instance, in theprevious example, user #1 has a wireless PDA and a SMS phone. If theevent occurs, and the PDA is turned-off, an alert is sent to the SMSphone instead.

IIM (Iteration instant messenger) interface 806 provides an interface tothe HM client 819-823, an enhanced IM application that allows secureconcurrent graphical collaboration and pen-based user input. In general,it is sometimes desirable to implement private instant messaging systemshaving enhanced capability (including different protocols, encryptioncapabilities, graphical processing/display capabilities, I/Ocapabilities, and/or the like) compared to public messaging systems(such as those available from Yahoo™, AOL™, and the like). IIM client isan example of a client in such a private instant messaging system.

IIM client 819-823 commonly connect through active collaboration server817, which marshals collaboration request from multiple IIM clients, andcombines connections whenever possible to improve overall systemperformance and scalability. Furthermore, active collaboration server817 synchronizes the text and graphical portions of the IIM session toinsure that all users view the same information at substantially thesame time.

Active collaboration server 817 further enforces security protocols asimplemented by the IIM client, in order to prevent unauthorizedinterception of the collaboration session. In one embodiment, IIM client819-823 implements a Triple DES security protocol to protect thecollaboration session and insure message integrity. Triple DES is anencryption algorithm whose security is based on a single secret key.Each key is generated (selected at random from all possible keys) foreach particular collaboration session.

In another embodiment, only one user in an IIM collaboration sessionneeds authorization to access a given alert or report. By virtue ofbeing authenticated to the session, all other users will receive thealert or report with the security privileges of authorized user, for aslong as these users participate in the session.

In addition to IIM interface 806, there is SMTP interface 807 and otherIM interface 809. SMTP, or simple mail transfer protocol, is the mostcommon protocol for sending email message on the internet. Through SMTPinterface 807, message center 272 can forward email notifications withthe event information to email server 815. Unlike IIM client 819-823,however, notification is not automatic. The user must first log ontomail server 815 with a SMTP client 827, such as MS Outlook and downloadthe messages. Likewise, other IM interface 809 represents traditional IMinterfaces to currently available IM systems 831, such as AOL InstantMessenger, MSN Messenger, Yahoo! Messenger, Microsoft Exchange 2000 IM,and Lotus Sametime. In contrast to SMTP, notification can be automatic,although communication is generally insecure. Furthermore, graphicalcollaboration is difficult.

For example, user #1 is a chemical engineer at a petroleum processingplant. He created a profile in user manager 811, in which he wants to benotified of specific events, such as a change in a process temperaturebeyond a certain range. The event occurs. Message center 272 forwardsthe notification to active collaboration server 817, through IIMinterface 806. Seeing the temperature dynamically change on his device,user # 1 realizes that he wants additional advice from user #2, hismanager. Through his IIM device, he instructs message center 272 toinitiate a request for collaboration with user #2. Receiving acollaboration request from his subordinate, user #2 accepts theconnection. User #1's display is immediately rendered on User 2'sdevice, upon which they collaborate on the matter at hand.

Referring to FIG. 8B, IIM client 823 and active collaboration server 817as shown in FIG. 8A, are described in greater detail. The user interfaceof IIM client 823 is comprised of four panes: a graphical display pane854, a chat text display pane 856, a pen entry pane 858, and a chat textentry pane 860. Graphical display pane 854 is the main rendering windowfor IIM client 823. It allows a user to make better sense of largeamounts of dynamic data, presenting changing information in an easilyaccessible, graphical visual representation. Chat text display pane 856displays IM messages in a formatted way, using a choice of colors andstyles. Pen entry pane 858, allows the IM device to recognize a user'shandwriting. Chat text entry pane 860 allows the user to enter textthrough a keyboard.

For example, user #1 is a network systems engineer monitoring traffic ata company's e-commerce web site. When network congestion reaches acertain point, active report engine 274 generates a report and forwardsit to user #1. Realizing that customers are starting to have difficultyplacing online orders, user # 1 initiates a connection with user #2, theweb site manager, and user #3, the customer service manager. Once bothaccept, user #1's display is immediately rendered on the other devices,upon which all can collaborate on the matter at hand.

In another embodiment, an instant messaging manager is advantageouslyemployed to rapidly alert intended recipients of data events. Referringto FIG. 9A, a simplified functional diagram is shown of a rules-basedmonitoring engine with alert capability, such as in a BI or OLAPapplication. Enterprise systems 902 comprise the series of applicationscommonly used to run and manage a business, such as OLTP, datawarehouse, and OLAP. OLTP (online transaction processing) applications902 are those enterprise systems that manage a company's basictransactions, such as order entry and billing systems. In order toconduct meaningful analysis, this information is often further placed ina more stable environment, optimized for random querying, such as a datawarehouse. OLAP enables trained users to perform sophisticated ad hocanalysis of data stored in a data warehouse.

Rules-based monitoring engine 916 monitors the applications inenterprise systems 902 for pre-defined events. A rule is a pre-definedprocedure comprising the event(s) to be monitored, and the subsequentaction or transformation that is required. For example, the event can bea specific transaction, a change in a file size, the publishing of areport, etc. Rules U/I 920 is typically graphical application thatallows a user to create sophisticated and complex rules, as well asstore the rules in the rules db 918 for use by rules based monitoringengine 916. In this case, the subsequent action is an alert.

When a specific event occurs, rules-based monitoring engine 916 forwardsan alert to notification engine 924 a, which properly formats the alertand transmits it via email system 915 a, pager system 915 b, or anothersystem through proprietary API 915 c. Alerts sent to email system 915 acan further contain an embedded link to a report generated by activereports engine 274, as shown if FIG. 2B.

For example, betting transactions would be normally stored in a casino'sgame transaction system. Wanting to be extra-attentive to high-rollers,a casino would configure the rules based monitoring engine 916 toobserve for any customer whose betting exceeds a specified threshold,upon which an alert would be sent to the closest pit boss with anembedded link to the customer record.

FIG. 9B, in accordance with one embodiment of the present invention,shows the simplified functional diagram of a rules-based monitoringengine with alert capability of FIG. 9A, with the addition of instantmessaging manager 924 b. Instant messaging (IM) is a means for sendingsmall, simple messages that are delivered immediately to online users.It differs from email primarily in that its primary focus is immediateend-user delivery. Common public instant message systems 915 d-f includeAOL Instant Messenger, MSN Messenger, Yahoo! Messenger, MicrosoftExchange 2000 IM, and Lotus Sametime. Through a locally installed clientapplication, a user can normally discover the presence of another user,and immediately begin a text conversation, or chat session. Many systemsalso have the capability for group chat sessions. Instant messagingmanager 924 b enables the rules based monitoring engine 916 to appear asan IM client to the various instant message systems 915. Therefore noadditional software is needed, beyond the IM client application that ismore than likely already installed.

As in FIG. 9A, there is shown a simplified functional diagram of arules-based monitoring engine with alert capability, such as in a BI orOLAP application. Rules-based monitoring engine 916 monitors theapplications in enterprise systems 902 for pre-defined events. Rules U/I920 is typically graphical application that allows a user to createsophisticated and complex rules, as well as store the rules in the rulesdb 918 for use by rules based monitoring engine 916. In this case, thesubsequent action is an alert.

Instant messaging manager 924 b properly formats the alert as an instantmessage and transmits to the intended recipient through one of thevarious instant message systems 915 d-f Unlike notification engine 924a, however, instant messaging manager 924 b also monitors the variousinstant message systems 915 d-f for changes in state for any subscribedusers. State is comprised of presence and status. Presence determines ifthe IM device is coupled to the given IM network, or at least reachablefrom the client. The given instant message system 915 d-f normallydetermines the presence of individual IM clients, and broadcast theinformation to interested parties, such as the instant messaging manager924 b. Status determines if the intended recipient is able to read andrespond to the instant message. Normally whether a recipient isavailable or not is a true or false question. However, it is common forrecipients to customize the unavailable status with further descriptiveinformation, such as “out to lunch”, “busy”, “away from desk”,“important meeting”, etc.

For instance, the IM device can be turned on and available, but the useris in an important meeting and does not wish to be disturbed. The usercan set the status to “important meeting” notifying any other subscribedusers that he will probably not be able to respond to the instantmessage until after the meeting. The rules-based monitoring engine 916,realizing that the user will not immediately read the instant message,will choose an alternative present and available user based on apre-determined notification rule. Rules-based monitoring engine 916 canforward an alert to instant messaging manager 924 b for immediatedelivery to the intended recipient.

Referring now to FIG. 10A, simplified pseudo-code is illustrated aswould be used by IM client manager 628, as shown in FIG. 6, to notifyingrunning processes of user status changes. In procedure 1,ProcessMessagesFromServer with a message argument, IM client manager 628receives a message from an instant message system. It then determineswhether it is a user status in procedure 7, case: UserStatuses. If so,then procedure 15 is called, Process_User_status_messages with anuserStatusObjects collection argument. It then updates the user datastructure at procedure 18, HashOfUserObjects.update, and subsequentlynotifies any active processes running on the active server platform ofthis status change.

FIG. 10B illustrates, in accordance with one embodiment of the presentinvention, simplified pseudo-code as would be used by IM client manager628 to determine presence and status for IM clients. In procedure 1, theBoolean IsUserPresent is passed a user (i.e., IM name) and optionaldegree of presence arguments (i.e., available, non-available, etc.).Initially in procedure 4, if(!HashOfUserObjects.contains) with a userargument, the entered user name is compared to existing list ofpotential users registered with the active data platform. If not, anexception is thrown, and the procedure returns an error. If true,procedure 8, if(HashOfUserObjects[user].degree>degree) further checks tosee if the optional degree of presence variable that was passed toprocedure 1 is less than the degree of presence previously stored in theactive data platform. The function then returns the result as either atrue or false.

FIG. 10C illustrates, in accordance with one embodiment of the presentinvention, simplified pseudo-code as would be used by IM client manager628 to subscribe to a specific IM user. IN procedure 1,RegisterInterestInUser( ) is passed a user (i.e., IM name) and optionaldegree of presence arguments(i.e., available, non-available, etc.). Thisis passed to procedure 3, CollectionOfInterestingUsers.add, whichsubsequently registers interest in the user.

In another embodiment, an event engine is advantageously employed tosubstantially assure the examination of a report by a user. Manyanalytical products such as business intelligence (BI) and onlineanalytical processing (OLAP) systems are capable of monitoring,scheduling, and broadcasting alerts via email or pager. These systems,however, cannot generally assure that the intended recipient promptlyreceives and reads the message. This presents a significant problem fortime-sensitive information, where minutes or even seconds can make adifference.

In the current invention, the event engine monitors the state oftransmitted alerts in an escalation table. Upon receipt of an alert, theuser reviews the received report. This is commonly done by manuallybrowsing for the report, or by clicking an embedded URL contained withinthe alert. If the user does not review the report within a specifiedtime, the escalation table can further escalate the alert to anotheruser based upon predefined rules. For instance, the alert is transmittedto the user's manager.

Referring to FIG. 11, a simplified functional diagram displaying theactive data platform is shown with elements of the notification andescalation process. Advantages include substantially improving alertaccountability in business intelligence applications. That is, enablingthe right person to receive critical information at the right time, andif not, escalating the information to the appropriate person.

Enterprise data 140 comprises those enterprise systems that manage acompany's basic transactions, such as order entry and billing systems.Active data cache 256 monitors transaction data packets 1104 generatedby enterprise data 140. Active data cache 256 further comprises userdata manager 1108, which describes user event interest, and monitoringrule manager 1111, that analyzes data packet 1104 for specific events.

Should an event of interest occur, monitoring rule manager 111 forwardsa rule fired message 1116 to the rules list manager 1120 of event engine257. Rules list manager 1120 further comprises the subsequent actionsrequired for the fired rule, such as the transmission of a notificationmessage to a user, the execution of a subsequent rule, or the generationof an accountability escalation event. In this case, notificationmessage 1130 is forwarded to message center 272. Rules list manager 1120also places an entry into escalation table 1120, describing notificationmessage 1130, the intended recipient, and the time the message was sent.If a report viewed message 1176 is not received within a pre-determinedamount of time, a timeout occurs, and escalation table 1122 notifiesescalation manager 1138, which in turn executes pre-configuredescalation rules, such as notification of a different person or entity,or the calling of a web service.

Upon receiving notification message 1130, user address manager 1142attempts to find a device address at which the user is currentlyavailable. Message center 272 further embeds a link in notificationmessage 1146, through which the user can review the corresponding reportfrom active reports engine 274.

The user subsequently receives notification message 1146 on his device,in this case, through a browser. If not already viewing the report, theuser can either locate the report by manually entering information suchas a URL, or can also simply click on an embedded link to the report.

Upon receiving a request, report supplier 1168 of report engine 274,generates the report from information in the active reports table 1170,and forwards it to user device 1150. A report viewed message 1176 isalso generated and forwarded to escalation table 1122, which in turndeactivates the previous notification message entry.

For example, a large multi-site manufacturing organization, such as FordMotor Company, would configure the active data platform to monitormanufacturing processing information, such as increasing part rejectrates, or outright machine failures. Should a machine failure actuallyoccur, an alert is forwarded to the appropriate manufacturing processengineer. The alert would contain an embedded link to the specificmachine's status report, as generated by active reports engine 274. Ifthe process engineer did not review the report within a few minutes (orany time period specified), a new alert would be immediately forwardedto the local plant manager for immediate action.

Referring to FIG. 12, a simplified diagram of a common instant messagingclient displaying notification message 1146 is shown in FIG. 10. In thiscase, an alert message with a link 1202 to the budgetbuster report isshown. Upon clicking link 1202, a report would open in a new browserwindow. Furthermore, a report viewed message 1176 would be generated andforwarded to escalation table 1122, as shown in FIG. 10.

In accordance with one aspect of the present invention, rule evaluationis advantageously distributed in order to improve efficiency. To furtherelaborate, a rule often comprises multiple interdependent components(i.e., event, constraint, condition, and action) that must be evaluatedand acted upon.

The first component of a rule is the event, which specifies the event ofinterest. An example of an event is when the sales volume exceeds 5,000units. If the sales volume exceeds 5,000 units, the event component issatisfied.

The second component of a rule is the constraint, which specifies theparameters that must be satisfied before evaluating an event and/or acondition and/or before applying the rule. A constraint is usuallyprovided for efficiency reasons and commonly comprises dates, times,and/or frequencies. For instance, if the specific event described in theevent clause (e.g., sales volume in the previous example) does not needto be monitored over the weekend or between certain times or more oftenthan a given frequency, then the constraint clause would instruct theevent engine to that effect. Typically a constraint is evaluated to beeither true or false. In one embodiment, if the constraint is evaluatedto be false by the event engine, the satellite evaluation engine isinformed accordingly and does not even need to spend its resourcesevaluating the event. Advantageously, efficiency is improved.

The third component of a rule is the condition, which further specifiesother attributes relevant to the specific event, which attributes mustbe satisfied before the action associated with the rule may be taken. Inthe previous example, the condition may be to take action only if thesales volume that fires the event is achieved without any specialpromotion in place. Generally speaking, all conditions may be thought ofas events but not all events are conditions.

The fourth component of a rule is the action, which determines thecourse of action taken should the event, constraint and/or conditioncomponents be satisfied. For instance, the sending of a notification toa specific person may be an action that needs to be taken if, as in theprevious example, during a weekday (constraint satisfied), the salesvolume exceeds 5,000 units (event satisfied) and the sales volume isachieved without any specific promotion in place (condition satisfied).

It should be noted that a rule typically includes an action but a ruledoes not require all three other components, i.e., event, condition, andconstraint. A rule may have one, two, or three of these components asdesired by the rule designer. Furthermore, each of the event, condition,constraint, and action components may be a complex Boolean operationcomprising multiple sub-components. A preferred embodiment, however, isa single event component per rule.

For example, an event may be satisfied if sales volume is greater than5,000 and the total revenue is greater than $10,000 (a Boolean operationof two sub-events).

In order to reduce design complexity, a common solution has been toevaluate and execute these rules in a centralized event engine. It isfound, however, that the information that needs to be monitored andevaluated can be found anywhere on the enterprise network. It is oftenthe case that the information that must be monitored and evaluated(e.g., the event or condition) may be distributed in one or moremachines (such as servers) remote from the computer executing thecentralized event engine. In some cases, only 5% of the information maybe relevant to a particular rule. Yet when the rule evaluation iscentralized, all the data that needs to be monitored and evaluated mustbe transmitted across the machine and/or process boundaries for thecentralized event engine to perform its rule evaluation task. In anetworked environment, the remaining 95% of the information that isneedlessly sent represents an inefficient use of scarce networkresources and bandwidth, as well as a detriment to performance.

In accordance with one embodiment of the invention, rule evaluation isdistributed in one or more satellite evaluation engines local to orcloser to the origin of the monitored information. The evaluation isdistributed in satellite evaluation engines that are in communicationwith an event engine. Distributed rule evaluation allows the evaluationof a rule to take place with reduced bandwidth usage and delay. Sinceactive data and the timely report/notification responsive to active dataare important aspects of the active data platform, minimizing delay isan important consideration, and the distributed evaluation mechanismsubstantially furthers that goal.

To facilitate the implementation of distributed rule evaluation, it ishighly preferable that a universal rule syntax be developed that allowsthe event engine to analyze any given rule and decides which portion ofthe rule should be distributed and which portion of the rule should beprocessed by the centralized event engine.

In accordance with one embodiment of the invention, a rule syntax isdeveloped in which the four components of a rule (event, constraint,condition, action) are specified as clauses in a specific order tofacilitate parsing.

For example, the following is a simplified example of a rule that may beexecuted:

Clause 1: ON viewsset.changed(“QTD Sales”) Clause 2: WITHOnlyDayWeek(“MON-FRI”) Clause 3: IF Time.Between(9,17) ANDDate.EndofQuarter( ) Clause 4: DO notify.send(“Joe”,”email”)

Clause 1 describes the event to be executed by the satellite evaluationengine, in this case, the viewset application. The event is a change toQTD Sales information. Clause 2 comprises the constraint clause. Itdescribes that the event will only be monitored from Monday to Friday.Clause 3 comprises the condition, further qualifying the situation thatoccasions the firing of the action. In this case, if the time wasbetween 9:00 a.m. and 5:00 p.m. (i.e., 1700 hrs), and if the datecorresponds to the end of the quarter. Clause 4 describes the action. Inthis case, the action is to send an email to user named Joe if theevent, constraint, and condition are satisfied. Of course, these fourcomponents may be ordered in a different order if another syntaxconstruct so dictates.

In accordance with one embodiment of the present invention, a rule isparsed to one or more core events, which are then distributed to one ormore appropriate satellite evaluation engines to facilitate evaluationof the distributed event(s). In the previous example, the rule may beparsed and the event pertaining to the sales volume may be distributedto, for example, the satellite evaluation engine associated with theactive data cache. The satellite valuation engine then evaluates themonitored data (sales volume in this example) and communicates theresult (which may be simply true/false or may include pertinent salesvolume data) back to the event engine. Meanwhile, the event engine isoffloaded from the task of handling that rule until the event issatisfied.

To further improve efficiency, the centralized event engine may not evenparse all components of a rule until the event is satisfied. Thus, if anevent is never satisfied, no resource has been wasted parsing the entirerule and preparing the centralized event engine and/or the satelliteevaluation engine(s) to handle the other components (which may neverneed to be handled if the event is never satisfied). Further, thesatellite evaluation engine may only send information back to the eventengine if the event evaluates to be true. Thus, if the sales volume isbelow 5,000 in the previous example, no message is sent from thesatellite evaluation engine to advantageously avoid wasting bandwidth.Of course, as mentioned earlier, the evaluation of an event may be heldoff by the satellite evaluation engine to further avoid wasting resourceunless the constraint is evaluated to be true by the centralized eventmonitor.

If the event is evaluated to be true at the satellite evaluation engine(and assuming any applicable constraint is also evaluated to be true),the satellite evaluation engine informs the centralized event engine,which may then evaluate the condition using either the same or anothersatellite evaluation engine or using the centralized resource. If thesame or a different satellite evaluation engine is also used to evaluatea condition, the event monitor may send out the parsed condition and askfor the result of the evaluation of the condition. As the exemplarysyntax above indicates, each of the event, constraint, condition, andaction may be (but not required in all cases) implemented as a function.Distributing rule evaluation thus may comprise using the appropriatesatellite evaluation engine to make the required function call.

Referring to FIG. 13, in accordance with one embodiment of the presentinvention, a simplified functional diagram illustrating the morerelevant components of an exemplary active data platform in whichdistributed rule evaluation is implemented. Event engine 257 employs asatellite evaluation engine manager 1302 to distribute and manage theevaluation of certain components of a rule in one or more eventsatellite evaluation engines. The distributed evaluation results arethen received by monitor manager 1302 for use by event engine 257.

Satellite evaluation engines 1036 a-1036 h are some exemplary satelliteevaluation engines employed by the active data platform of FIG. 13.Viewset satellite evaluation engine 1306 a observes changes to databasedata objects, such as the modification of a database filter to certainchange in the data in the active data cache. Presence satelliteevaluation engine 1306 b observes changes to the availability of devicesand the status of users. Time satellite evaluation engine 1306 cobserves time changes. Date satellite evaluation engine 1306 d observesdates changes. System satellite evaluation engine 1306 e observeschanges to the underlying operating systems or applications, forinstance, a change in the virtual memory or a cache miss. File satelliteevaluation engine 1306 f observes changes to a given file as stored in afile system. External satellite evaluation engine 1306 h observesexternally generated events through an API. These external events can beused for integration with other applications. Other satellite evaluationengine 1306 i represents additional events that can be programmaticallymonitored by event engine 257.

In accordance with another embodiment of the present invention, there isprovided a universal function call syntax to facilitate the task ofdistributing certain aspects of rule evaluation to one or more satelliteevaluation engines. As discussed above, the rule syntax allows an event,a constraint, a condition, or an action to be specified as a function.Thus, the function call syntax may have the following construct:

-   -   satname.funcname(argument₁, argument_(N))

where satname is the name of the satellite evaluation engine. Funcname,which is separated from satname by a symbol such as a dot, is the nameof the function. The arguments represent optional arguments of thefunction.

By creating a universal function call syntax, the inventionsubstantially simplifies the task of specifying that a particularsatellite evaluation engine should handle a particular event orcondition. Furthermore, the function syntax improves scalability in thata new satellite evaluation engine is added to the system, only thesatellite evaluation engine name needs to be changed and the remainderof the syntax may be reused. Also, if a new event or condition isspecified vis-à-vis an existing satellite evaluation engine, only thefunction name needs to be changed.

In one embodiment, a rule template library may be provided to allowusers to leverage on work done by others. A rule template is simply arule with certain argument(s) not completely specified. For example, arule template may specify that if the sales volume exceeds 5,000 on aweekday and no special promotion is involved then notify person X. Inthis case, person X represents the argument that remains to be filledout to turn the rule template into a rule instance. In this example, thefilling out of the person may be automatically accomplished by fillingin the missing argument with the identity of the user accessing the ruletemplate. In other cases, the missing arguments may be filled out by theuser wishing to employ the rule template.

Of course the user can always edit existing rules (i.e., complete ruleinstances) to fit his needs. For example, the user can access anexisting report and edit the rules therein to modify the argumentsrelated to the event, condition, constraint, and/or action so that thenewly created report would contain the information needed. The universalrule syntax renders it simple to implement rule templates and makes iteasy for users to convert a rule template to a rule instance or tomodify an existing rule to fit his needs.

While this invention has been described in terms of several preferredembodiments, there are alterations, permutations, and equivalents whichfall within the scope of this invention. For example, although referenceis given to Sagent Business Intelligence Solutions, it should beunderstood that the invention can also integrate with other businessintelligence and ETL solutions. It should also be noted that there aremany alternative ways of implementing the apparatuses of the presentinvention. It is therefore intended that the following appended claimsbe interpreted as including all such alterations, permutations, andequivalents as fall within the true spirit and scope of the presentinvention.

Advantages of the invention include optimizing the presence-awaredelivery of relevant information to a device in a timely manner, andrendered in a dynamic format. Additional advantages include thecontinuous extraction of information from data sources without the needfor manual queries, or the need of additional user training.

Having disclosed exemplary embodiments and the best mode, modificationsand variations may be made to the disclosed embodiments while remainingwithin the subject and spirit of the invention as defined by thefollowing claims.

1. A method for performing an action, in a distributed environment, uponoccurrence of a monitored event related to a set of data elements, themethod comprising: providing a rule, the rule comprising an eventidentification component specifying an event to be monitored and anaction component specifying an action to be performed upon occurrence ofthe event; determining, from the rule, if the event identificationcomponent is to be evaluated by a remote event engine from a pluralityof remote event engines executing on one or more computers remote from acentralized event engine executing on a first computer and if the actioncomponent is to be evaluated by the remote event engine from theplurality of remote event engines; evaluating the event identificationcomponent and the action component of the rule, wherein, for a componentof the rule that is determined to be evaluated by the remote eventengine, the component of the rule is evaluated by the remote eventengine at a computer remote from the first computer, wherein theevaluating comprises monitoring occurrence of the event specified by theevent identification component, and performing the action specified bythe action component upon occurrence of the event.
 2. The method ofclaim 1, wherein said rule further comprises a constraint component,wherein subsequent steps occur if said constraint component is true, andwherein the constraint component specifies an attribute of the set ofdata elements, the attribute being satisfied prior to performing theaction specified by the action component.
 3. The method of claim 2,wherein said constraint component further comprises a time element. 4.The method of claim 2, wherein said constraint component furthercomprises a date element.
 5. The method of claim 2, wherein saidconstraint component further comprises a frequency element.
 6. Themethod of claim 1, wherein said rule further comprises a conditioncomponent, wherein said performing step occurs if said conditioncomponent is true.
 7. The method of claim 6, wherein said conditioncomponent further comprises indicia for further analysis of said set ofdata elements.
 8. An apparatus for performing an action, in adistributed environment, upon occurrence of a monitored event related toa set of data elements, the method comprising: means for providing arule, the rule comprising an event identification component specifyingan event to be monitored and an action component specifying an action tobe performed upon occurrence of the event; means for determining, fromthe rule, if the event identification component is to be evaluated by aremote event engine from a plurality of remote event engines executingon one or more computers remote from a centralized event engineexecuting on a first computer and if the action component is to beevaluated by the remote event engine from the plurality of remote eventengines; means for evaluating the event identification component and theaction component of the rule, wherein, for a component of the rule thatis determined to be evaluated by the remote event engine, the componentof the rule is evaluated by the remote event engine at a computer remotefrom the first computer, wherein the evaluating comprises means formonitoring occurrence of the event specified by the event identificationcomponent, and means for performing the action specified by the actioncomponent upon occurrence of the event.
 9. The apparatus of claim 8,wherein said rule further comprises a constraint component, whereinsubsequent steps occur if said constraint component is true, and whereinthe constraint component specifies an attribute of the set of dataelements, the attribute being satisfied prior to performing the actionspecified by the action component.
 10. The apparatus of claim 9, whereinsaid constraint component further comprises a time element.
 11. Theapparatus of claim 9, wherein said constraint component furthercomprises a date element.
 12. The apparatus of claim 9, wherein saidconstraint component further comprises a frequency element.
 13. Theapparatus of claim 8, wherein said rule further comprises a conditioncomponent, wherein said means for performing the action occurs if saidcondition component is true.
 14. The apparatus of claim 13, wherein saidcondition component further comprises indicia for further analysis ofsaid set of data elements.